Exploit & Vulnerability Intelligence

Exploit Intelligence

Leverage best-in-class exploit intelligence from VulnCheck to understand the state of vulnerability exploitation for a given vulnerability.

VulnCheck Exploit & Vulnerability Intelligence replaces the need to have separate scripts for downloading the NIST National Vulnerability Database (NVD), the CISA KEV catalog, etc. By integrating with VulnCheck Exploit & Vulnerability Intelligence, you're integrating with an Open Source Intelligence (OSINT) product that has best-in-class information, in a timely manner, on vulnerability exploitation and vulnerabilities generally.

Most importantly, unlike other purely vulnerability-centric solutions, VulnCheck marries exploit intelligence with vulnerability intelligence. By coupling exploit intelligence with vulnerability intelligence, better insights into vulnerability prioritization & remediation can be gained.

On the exploitation side, VulnCheck Exploit & Vulnerability Intelligence include a wide range of features designed to help understand the state of vulnerability exploitation. Such features include, but are not limited to:

Monitoring of Git repositories, blog posts and other sources for new exploit PoCs
Review and validation of exploit PoCs
Caching of exploit PoCs
Exploit Maturity classification
Exploit Type classification
Evidence of known exploitation/exploitation in-the-wild
Exploit/Exploitation timelines
Ransomware families, threat actor, botnet, and exploit counts

Example Exploit Record

The VulnCheck API makes it easy to get started with VulnCheck Exploit & Vulnerability Intelligence. To start, simply query the exploits index via the /v3/index/:index?cve=:cve API as follows:

curl --request GET \
    --url https://api.vulncheck.com/v3/index/exploits?cve=CVE-2024-4577 \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer insert_token_here'

package main

import (
 "context"
 "encoding/json"
 "fmt"
 "log"
 "os"

 vulncheck "github.com/vulncheck-oss/sdk-go-v2/v2"
)

func main() {
 configuration := vulncheck.NewConfiguration()
 configuration.Scheme = "https"
 configuration.Host = "api.vulncheck.com"

 client := vulncheck.NewAPIClient(configuration)

 token := os.Getenv("VULNCHECK_API_TOKEN")
 auth := context.WithValue(
  context.Background(),
  vulncheck.ContextAPIKeys,
  map[string]vulncheck.APIKey{
   "Bearer": {Key: token},
  },
 )
 resp, httpRes, err := client.IndicesAPI.IndexExploitsGet(auth).Cve("CVE-2024-4577").Execute()

 if err != nil || httpRes.StatusCode != 200 {
  log.Fatal(err)
 }

 prettyJSON, err := json.MarshalIndent(resp.Data, "", "  ")
 if err != nil {
  log.Fatalf("Failed to generate JSON: %v", err)
  return
 }

 fmt.Println(string(prettyJSON))
}

import vulncheck_sdk

configuration = vulncheck_sdk.Configuration(host="https://api.vulncheck.com/v3")
configuration.api_key["Bearer"] = "insert_token_here"

with vulncheck_sdk.ApiClient(configuration) as api_client:
    indices_client = vulncheck_sdk.IndicesApi(api_client)

    api_response = indices_client.index_exploits_get(cve="CVE-2024-4577")

    print(api_response.data)

vulncheck index browse exploits --cve CVE-2024-4577

The above example searches the exploits index for information on CVE-2024-4577.

Example API Response for Exploits by CVE

After calling the /v3/index/exploits?cve=:cve API endpoint with a valid CVE identifier, a response similar to the below will be returned:

{
  "_benchmark": 0.046138,
  "_meta": {
    "timestamp": "2025-10-22T17:48:19.609308818Z",
    // ...
  },
  "data": [
    {
      "id": "CVE-2024-4577",
      "public_exploit_found": true,
      "commercial_exploit_found": true,
      "weaponized_exploit_found": true,
      "max_exploit_maturity": "weaponized",
      "reported_exploited_by_honeypot_service": true,
      "reported_exploited_by_vulncheck_canaries": true,
      "reported_exploited": true,
      "reported_exploited_by_threat_actors": true,
      "reported_exploited_by_ransomware": true,
      "reported_exploited_by_botnets": true,
      "inKEV": true,
      "inVCKEV": true,
      "timeline": {
        "nvd_published": "2024-06-09T20:15:09.55Z",
        "nvd_last_modified": "2025-10-21T23:16:37.27Z",
        "first_exploit_published": "2023-01-13T00:00:00Z",
        "first_exploit_published_weaponized_or_higher": "2024-06-07T00:00:00Z",
        "most_recent_exploit_published": "2025-08-25T00:00:00Z",
        "first_reported_threat_actor": "2024-06-07T00:00:00Z",
        "most_recent_reported_threat_actor": "2025-10-07T00:00:00Z",
        "first_reported_ransomware": "2024-06-10T00:00:00Z",
        "most_recent_reported_ransomware": "2024-08-02T00:00:00Z",
        "first_reported_botnet": "2024-07-25T00:00:00Z",
        "most_recent_reported_botnet": "2024-11-07T00:00:00Z",
        "cisa_kev_date_added": "2024-06-12T00:00:00Z",
        "cisa_kev_date_due": "2024-07-03T00:00:00Z",
        "vulncheck_kev_date_added": "2024-06-07T00:00:00Z",
        "vulncheck_kev_date_due": "2024-07-03T00:00:00Z"
      },
      "trending": {
        "github": false
      },
      "epss": {
        "epss_score": 0.94374,
        "epss_percentile": 0.99961,
        "last_modified": "2025-10-20T21:40:23.840873662Z"
      },
      "counts": {
        "exploits": 92,
        "threat_actors": 4,
        "botnets": 3,
        "ransomware_families": 2
      },
      "exploits": [
        {
          "url": "https://raw.githubusercontent.com/vulncheck-oss/0day.today.archive/main/web-applications/39659.txt",
          "name": "PHP &lt; 8.3.8 - Unauthenticated Remote Code Execution (Windows) Exploit",
          "refsource": "0day.today",
          "date_added": "2024-06-14T00:00:00Z",
          "exploit_maturity": "poc",
          "exploit_availability": "publicly-available",
          "validation_level": "third-party-aggregated"
        },
        {
          "url": "https://api.vulncheck.com/v3/index/initial-access?cve=CVE-2024-4577",
          "name": "PHP CGI Argument Injection",
          "refsource": "vulncheck-initial-access",
          "date_added": "2024-06-08T00:00:00Z",
          "exploit_maturity": "weaponized",
          "exploit_availability": "commercially-available",
          "exploit_type": "initial-access",
          "validation_level": "vulncheck-authored",
          "clone_ssh_url": "git@git.vulncheck.com:vulncheck/initial-access.git"
        }
        // ...
      ],
      "reported_exploitation": [
        {
          "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
          "name": "PHP-CGI OS Command Injection Vulnerability",
          "refsource": "cisa-kev",
          "date_added": "2024-06-12T00:00:00Z"
        },
        {
          "url": "https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-11&host_type=src&vulnerability=cve-2024-4577",
          "name": "PHP (PHP-CGI) (CVE-2024-4577)",
          "refsource": "shadowserver-exploited",
          "date_added": "2024-06-11T00:00:00Z"
        }
        // ...
      ]
    }
  ]
}

The above example response shows what the exploits index returns for CVE-2019-3396.

Exploits Attribute Details

Attribute	Meaning
id	CVE ID
public_exploit_found	A public exploit has been discovered
commercial_exploit_found	A commercial exploit is privately for sale as part of a commercial offering
weaponized_exploit_found	Weaponized refers to an exploit that is explicitly malicious, such as cases where the exploit is contained within malware (e.g., a malicious Microsoft Word document), has been reported as exploited in the wild, or facilitates "point & click" exploitation (e.g., works against all or most targets and works reliably, such as exploits in MetaSploit, VulnCheck Initial Access Intelligence, CANVAS, or Core Impact). Additionally, weaponized exploits typically have secondary payloads, droppers, or implants.
reported_exploited_by_honeypot_service	Exploitation activity has triggered a third-party honeypot.
reported_exploited_by_vulncheck_canaries	Exploitation activity has triggered a VulnCheck canary.
reported_exploited	Reported Exploitation has been confirmed and the vulnerability is known to be exploited / exploited in the wild.
reported_exploited_by_threat_actors	A threat actor has been attributed with the vulnerability.
reported_exploited_by_ransomware	The vulnerability has been used in a ransomware campaign.
reported_exploited_by_botnets	One or more Botnets has been attributed to the vulnerability.
inKEV	Is included in the CISA KEV (Known Exploited Vulnerabilities) catalog.
inVCKEV	Is included in the VulnCheck KEV (Known Exploited Vulnerabilities) catalog.

Exploit Maturity

max_exploit_maturity	Meaning
Weaponized	Weaponized refers to an exploit that is explicitly malicious, such as cases where the exploit is contained within malware (e.g., a malicious Microsoft Word document), has been reported as exploited in the wild, or facilitates "point & click" exploitation (e.g., works against all or most targets and works reliably, such as exploits in MetaSploit, VulnCheck Initial Access Intelligence, CANVAS, or Core Impact). Additionally, weaponized exploits typically have secondary payloads, droppers, or implants.
POC	"POC" (proof of concept), is currently anything that can be used to demonstrate exploitation. This can be a blog post, a curl request, a python script, etc.

max_exploit_maturity

Meaning

Weaponized

Weaponized refers to an exploit that is explicitly malicious, such as cases where the exploit is contained within malware (e.g., a malicious Microsoft Word document), has been reported as exploited in the wild, or facilitates "point & click" exploitation (e.g., works against all or most targets and works reliably, such as exploits in MetaSploit, VulnCheck Initial Access Intelligence, CANVAS, or Core Impact). Additionally, weaponized exploits typically have secondary payloads, droppers, or implants.

POC

"POC" (proof of concept), is currently anything that can be used to demonstrate exploitation. This can be a blog post, a curl request, a python script, etc.

Exploit Timeline

Timeline Attribute	Meaning
nvd_published	When NVD Published the vulnerability.
nvd_last_modified	When NVD last modified the vulnerability
first_exploit_published	When the first exploit was published
first_exploit_published_weaponized_or_higher	When the first weaponized exploit or exploitation evidence was available.
most_recent_exploit_published	When the last exploit was published
first_reported_threat_actor	When the first threat actor was reported
most_recent_reported_threat_actor	When the most recent threat actor was reported
first_reported_ransomware	When ransomware was first reported
most_recent_reported_ransomware	When ransomware was most recently reported
first_reported_botnet	When a botnet was first reported
most_recent_reported_botnet	When a botnet was most recently reported
cisa_kev_date_added	When the CVE was added to CISA KEV
cisa_kev_date_due	CISA KEVs due date
vulncheck_kev_date_added	When first known exploitation was reported

* timeline attributes are omitted if there is no evidence or a null date present.

EPSS

EPSS Attribute	Meaning
epss_score	The EPSS score
epss_precentile	The EPSS percentile

Counts

Counts Attribute	Meaning
exploits	The total number of exploits discovered.
threat_actors	The total number of threat actors attributed.
botnets	The total number of botnets attributed.
ransomware	The total number of ransomware campaigns using the vulnerability.

Exploit Type Classification

VulnCheck Exploit & Vulnerability Intelligence maintains a Exploit Type field in the block of exploits that are indexed. The Exploit Type field helps distinguish between high impact exploits, like initial access exploits, and lower impact exploits, like denial of service exploits.

Exploit Type Definitions

Exploit Type	Meaning
Initial Access	Initial Access exploits are typically the most high impact exploit published. These vulnerabilities, also sometimes referred to as Remote Code Execution (RCE) vulnerabilities, are remote in nature, and typically do not require credentials to exploit.
Remote with credentials	Remote with credentials exploits are exploits that are remote, typically targeting network-bound applications, but require credentials to exploit.
Local	Examples of local exploits include those targeting setuid binaries on Linux.
Client-side	Examples of client-side exploits include those targeting client applications, such as Microsoft Word or Excel.
Infoleak	Infoleak exploits leak data from a target, without compromising the integrity of such a target.
Denial of Service	Denial of Service exploits typically cause a service or application to crash. Note: Often a denial-of-service exploit targets an initial-access vulnerability, prior to an initial-access exploit being posted.

Exploit Availability

Exploit Availability	Meaning
commercially-available	The exploit is commercially available such as VulnCheck Initial Access exploits and Core Impact exploits.
publicly-available	The exploit is publicly available such as git based exploits, blog posts, Metasploit modules and Nuclei templates.
privately-available	The exploit is not available publicly or commercially.

Validation Level

Each entry in the exploits array carries a validation_level describing how much validation that particular exploit has received. The values below are ordered from strongest to weakest evidence.

Validation Level	Meaning
vulncheck-authored	Written and maintained by VulnCheck exploit developers.
vulncheck-exploit-dev-review	Technically reviewed by VulnCheck exploit developers.
vulncheck-analyst-review	Reviewed by VulnCheck analysts for relevance and credibility, but not necessarily executed.
third-party-validated	A reputable third party claims or demonstrates that the exploit works.
third-party-aggregated	Collected by a third party without evidence of technical validation.
uncategorized	Pending assignment of a validation level.

Entries in reported_exploitation do not carry a validation level. Those are reports that a vulnerability has been exploited, rather than exploits themselves.

Cached Exploit Repositories

Git-hosted exploits — those with a refsource of github-exploits, gitlab-exploits, gitee-exploits, bitbucket-exploits or codeberg-exploits — are reviewed by VulnCheck exploit developers and then cloned once into VulnCheck's own git service. That clone is a deliberate point-in-time snapshot: VulnCheck never re-fetches it, so what you retrieve is what was reviewed, even if the upstream repository is later rewritten, force-pushed, made private or deleted. The snapshot can therefore be older than the live repository. That is the guarantee being offered, not a defect.

Attribute	Meaning
clone_ssh_url_cached	SSH URL of VulnCheck's cached clone of the repository.
commit_hash	The 40-character hex commit that VulnCheck's cached clone is pinned to.
date_cached	RFC3339 timestamp of when VulnCheck froze its copy of the repository.

`date_added` is not a review date

On a git-sourced exploit entry, date_added describes the upstream repository — normally the date that repository was created. It is not the date VulnCheck reviewed the exploit, and it is not the date VulnCheck cached the repository; the two routinely differ. For the latter, use date_cached.

`reference_url` still tracks the live repository

reference_url names a branch, not a commit, so it resolves against whatever sits at the head of that branch today. It is not pinned. An immutable form is reconstructable by substituting commit_hash for the branch reference:

Form	URL
Branch reference, mutable	`https://raw.githubusercontent.com/<example user>/CVE-0000-00000-PoC/refs/heads/main/CVE-0000-00000-PoC.sh`
Pinned to `commit_hash`, immutable	`https://raw.githubusercontent.com/<example user>/CVE-0000-00000/<commit_hash>/CVE-0000-00000.sh`

The same substitution gives an immutable view of the whole tree, in the form https://github.com/<owner>/<repo>/tree/<commit_hash>.

Verifying the cached clone

Clone the cached copy and confirm that its HEAD is the published commit_hash:

git clone git@git-poc.vulncheck.com:github.com/<owner>/<repo>.git
cd <repo>
git rev-parse HEAD

The value printed matches the commit_hash on the exploit entry.

Introduction

Vulnerability Intelligence